Clustering method and device of portable execute (PE) files
A technology for executing file and clustering methods, applied in the field of network communication, can solve problems such as inability to cluster, large differences in PE files, and large computational complexity, achieve improved capabilities and early warning capabilities, reduce storage costs, and improve matching. The effect of efficiency
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0045] see figure 1 , an embodiment of the present invention provides a method for clustering PE files, the method comprising:
[0046] 101. Extract the features of the portable executable PE file;
[0047] 102. Generate a PE file identifier corresponding to the PE file according to the characteristics of the PE file;
[0048] 103. Perform clustering on the PE files according to the PE file identifiers.
[0049] Specifically, after extracting the features of the portable executable PE file, it includes:
[0050] The features of the extracted PE file are formed into a PE file feature set; the PE file feature set includes at least one feature;
[0051] Correspondingly, according to the characteristics of the PE file, a PE file identifier corresponding to the PE file is generated, including:
[0052] According to the PE file feature set, a PE file identifier corresponding to the PE file is generated.
[0053] Specifically, according to the characteristics of the PE file, a P...
Embodiment 2
[0063] see figure 2 , an embodiment of the present invention provides a method for clustering PE files, the method comprising:
[0064] 201. Extract features of the portable executable PE file;
[0065] Specifically, PE file is a file format under Windows, which widely exists in Windows, and most executable virus files are in PE file format;
[0066] Extract a set of features of the PE file from the PE file. The features of the PE file can be instruction sequence, import function name, export function name and visible string, etc., and other features of the PE file can also be extracted. For extracting the features of the PE file This embodiment of the present invention does not limit the number of . function name, but there are only two features in the PE file: the instruction sequence and the imported function name, and there is no feature of the exported function name, so you only need to extract the instruction sequence and the imported function name.
[0067] 202. For...
Embodiment 3
[0081] see image 3 , an embodiment of the present invention provides a portable executable file clustering device, the device includes:
[0082] The extraction module 301 is used to extract the features of the portable executable PE file;
[0083] The generating module 302 is used for generating a PE file identifier corresponding to the PE file according to the characteristics of the PE file;
[0084] The clustering module 303 is configured to cluster the PE files according to the PE file identifiers.
[0085] Specifically, the extraction module 301 is configured to, after extracting the features of the portable executable PE file, form the features of the extracted PE files into a PE file feature set; the PE file feature set includes at least one feature;
[0086] Correspondingly, the generating module 302 is configured to generate a PE file identifier corresponding to the PE file according to the PE file feature set.
[0087] Specifically, the generation module 302 inclu...
PUM
Abstract
Description
Claims
Application Information
- R&D Engineer
- R&D Manager
- IP Professional
- Industry Leading Data Capabilities
- Powerful AI technology
- Patent DNA Extraction
Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic, Popular Technical Reports.
© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap|About US| Contact US: help@patsnap.com